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REMARKS 

The Office Action dated August 8, 2006 has been carefully reviewed and the 
foregoing amendment has been made in consequence thereof. 

Claims 1-5 and 7-16 are now pending in this application. Claims 1-15 stand rejected. 
Claim 16 is withdrawn from consideration. Claim 1 stands objected to. 

The objection to Claim 1 is respectfully traversed. Claim 1 is amended to recite "the 
centralized database." Claim 5 is also amended to recite "the centralized interactive 
database." For at least the reasons set for above, Applicants respectfully request that the 
objection to Claim 1 be withdrawn. 

The rejection of Claims 1 and 5 under 35 U.S.C. § 101 as being directed to non- 
statutory subject matter is respectfully traversed. Claim 1 has been amended to recite "[a] 
method for providing access to users based on user profiles and using a web-based system 
that includes a server system coupled to a centralized interactive database and at least one 
client system, said method comprising the steps of . . . determining whether to grant the user 
access to an application after completing an evaluation based on the electronic profiles, pre- 
determined rules, and operating methodology in response to a request from the user for 
access to the application; if the user is denied access to the application, notifying the user of 
the denial to access the application; if the user is granted access to the application, 
determining whether to grant the user access to a set of specific data within the application 
after completing an evaluation based on the electronic profiles, pre-determined rules, and 
operating methodology in response to a request from the user for access to the set of specific 
data; if the user is denied access to the set of specific data . . . prompting the user to complete 
a request for quick approval wherein the request for quick approval includes a list of data for 
approval . . . automatically determining, using an internal exception access process an 
approval or a disapproval of quick access based on pre-established criteria and the list of data 
for approval; if the request for quick approval is approved, at least one of automatically 
adding a rule to the centralized database and automatically adding the user to the centralized 
database for access to the set of specific data ... if the rule is added, updating an exception 
list . . . if the user is added, updating the centralized database to permit user access to the set 
of specific data . . . notifying the user of the approval of the request for quick approval; if the, 
request for quick approval is denied, notifying the user of the denial of the request for quick 
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approval; and if the user is granted access to the set of specific data, making the set of 
specific data available to the user." 

Claim 5 has been amended to recite "[a] method for managing user profile 
information, including managing access control to applications and data by implementing a 
level of security across the different applications that is the same for each application, using a 
web-based system that includes a server system coupled to a centralized interactive database 
and at least one client system, said method comprising the steps of . . . providing capabilities 
for a user to request access to information that the user currently does not have access to; 
tracking a status of a request using a tracking component coupled to the centralized 
interactive database; obtaining a decision of whether to grant the user access to a user 
requested application from an owner of the application requested; implementing the decision 
comprising . . . if the user is denied access to the application, notifying the user of the denial 
to access the application; if the user is granted access to the application, determining whether 
to grant the user access to a set of specific data within the application after completing an 
evaluation based on the electronic profiles, pre-determined rules, and operating methodology 
in response to a request from the user for access to the set of specific data; if the user is 
denied access to the set of specific data . . . prompting the user to complete a request for 
quick approval wherein the request for quick approval includes a list of the information the 
user is requesting access to for approval . . . automatically determining, using an internal 
exception access process an approval or a disapproval of quick access based on pre- 
established criteria and the list of information the user is requesting access to; if the request 
for quick approval is approved, at least one of automatically adding a rule to the centralized 
interactive database and automatically adding the user to the centralized interactive database 
for access to the set of specific data ... if the rule is added, updating an exception list ... if 
the user is added, updating the centralized interactive database to permit the user access to the 
set of specific data . . . notifying the user of the approval of the request for quick approval; if 
the request for quick approval is denied, notifying the user of the denial of the request for 
quick approval; and if the user is granted access to the set of specific data, making the set of 
specific data available to the user." 

Applicants respectfully submit that the method provides a useful, concrete, and 
tangible result because results from decisions, approval/granted conditions and 
disapproval/denied conditions are known and used in the methods to provide notification 
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and/or information to a user as positively recited in the amended claims. Accordingly, 
Applicant submits that Claims 1 and 5 satisfy the requirements of Section 101. 

For at least the reasons set forth above, Applicants respectfully requests that the 
Section 101 rejection of Claims 1 and 5 be withdrawn. 

The rejection of Claims 1 and 5 under 35 U.S.C. § 112, second paragraph, is 
respectfully traversed. Claim 1 has been amended to further clarify that the user being 
referenced. Claim 5 has been amended to further clarify items being referenced. For at least 
the reasons set forth above, Applicants respectfully request that the Section 112 rejection of 
Claims 1 and 5 be withdrawn. 

The rejection of Claims 1, 3-11, and 13-15 under 35 U.S.C. § 102 (b) as being 
anticipated by Kraenzel (U.S. Patent 6,513,039) ("Kraenzel") is respectfully traversed. 

Kraenzel describes a system for automatically generating a profile of a network user 
based on a network Access Control List (ACL) that includes all objects/applications which 
users may have access. The system determines all objects that are accessible by a particular 
user, determines the subject matter of such objects, determines the privileges the user has 
associated with each such object, applies inferencing rules to determine a user's affinity for 
each such object and associated subject matter, updates/generates a user profile reflecting the 
determined affinity of the user, and allows the user to edit/select which user affinities are 
inserted into the profile. 

As illustrated in Figure 3, Kraenzel describes that the system accesses a database 
containing one or more objects requested by a user, and retrieves the user's access privileges 
for the object(s) requested. If the user's access privileges meet the minimum requirements set 
by the object administrator, the system retrieves the requested object(s) and presents the 
object(s) to the user. If the user's access privileges do not meet the minimum requirements 
set by a system administrator for that object(s), the system determines whether the user has 
requested additional privileges from the system administrator. In other words, whether the 
user has requested additional privileges from the system administrator is determined only 
when the user privilege does not meet requirements for the object requested. Notably, 
Kraenzel does not describe or suggest determining whether the user has requested additional 
privileges when the user has already been granted access to the object/application. 
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Claim 1 recites a method for providing access to users based on user profiles and 
using a web-based system that includes a server system coupled to a centralized interactive 
database and at least one client system, the method including "determining whether to grant 
the user access to an application after completing an evaluation based on the electronic 
profiles, pre-determined rules, and operating methodology in response to a request from the 
user for access to the application; if the user is denied access to the application, notifying the 
user of the denial to access the application; if the user is granted access to the application, 
determining whether to grant the user access to a set of specific data within the application 
after completing an evaluation based on the electronic profiles, pre-determined rules, and 
operating methodology in response to a request from the user for access to the set of specific 
data; if the user is denied access to the set of specific data . . . prompting the user to complete 
a request for quick approval wherein the request for quick approval includes a list of data for 
approval . . . automatically determining, using an internal exception access process an 
approval or a disapproval of quick access based on pre-established criteria and the list of data 
for approval; if the request for quick approval is approved, at least one of automatically 
adding a rule to the centralized database and automatically adding the user to the centralized 
database for access to the set of specific data ... if the rule is added, updating an exception 
list . . . if the user is added, updating the centralized database to permit the user access to the 
set of specific data . . . notifying the user of the approval of the request for quick approval; if 
the request for quick approval is denied, notifying the user of the denial of the request for 
quick approval; and if the user is granted access to the set of specific data, making the set of 
specific data available to the user." 

Kraenzel does not describe or suggest a method for providing access to users based on 
user profiles and using a web-based system that includes a server system coupled to a 
centralized interactive database and at least one client system as recited in Claim 1. More 
specifically, Kraenzel does not describe or suggest a method including, if the user is granted 
access to an application, determining whether to grant the user access to a set of specific data 
within the application. Rather, in contrast to the present invention, Kraenzel describes 
determining whether the user has requested additional privileges only when the user is denied 
access to the object/application. Accordingly, for at least the reasons set forth above, 
Applicants respectfully submit that Claim 1 is patentable over Kraenzel. 
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Claims 3 and 4 depend, directly and indirectly, from independent Claim 1 . When the 
recitations of Claims 3 and 4 are considered in combination with the recitations of Claim 1 , 
Applicants submit that dependent Claims 3 and 4 likewise are patentable over Kraenzel. 

Claim 5 recites a method for managing user profile information, including managing 
access control to applications and data by implementing a level of security across the 
different applications that is the same for each application, using a web-based system that 
includes a server system coupled to a centralized interactive database and at least one client 
system, the method including "providing capabilities for a user to request access to 
information that the user currently does not have access to; tracking a status of a request 
using a tracking component coupled to the centralized interactive database; obtaining a 
decision of whether to grant the user access to a user requested application from an owner of 
the application requested; implementing the decision comprising ... if the user is denied 
access to the application, notifying the user of the denial to access the application; if the user 
is granted access to the application, determining whether to grant the user access to a set of 
specific data within the application after completing an evaluation based on the electronic 
profiles, pre-determined rules, and operating methodology in response to a request from the 
user for access to the set of specific data; if the user is denied access to the set of specific data 
. . . prompting the user to complete a request for quick approval wherein the request for quick 
approval includes a list of the information the user is requesting access to for approval . . . 
automatically determining, using an internal exception access process an approval or a 
disapproval of quick access based on pre-established criteria and the list of information the 
user is requesting access to; if the request for quick approval is approved, at least one of 
automatically adding a rule to the centralized interactive database and automatically adding 
the user to the centralized interactive database for access to the set of specific data ... if the 
rule is added, updating an exception list ... if the user is added, updating the centralized 
interactive database to permit the user access to the set of specific data . . . notifying the user 
of the approval of the request for quick approval; if the request for quick approval is denied, 
notifying the user of the denial of the request for quick approval; and if the user is granted 
access to the set of specific data, making the set of specific data available to the user." 

Kraenzel does not describe or suggest a method for managing user profile 
information, including managing access control to applications and data by implementing a 
level of security across the different applications that is the same for each application, using a 
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web-based system that includes a server system coupled to a centralized interactive database 
and at least one client system as recited in Claim 5. More specifically, Kraenzel does not 
describe or suggest a method including, if the user is granted access to an application, 
determining whether to grant the user access to a set of specific data within the application. 
Rather, in contrast to the present invention, Kraenzel describes determining whether the user 
has requested additional privileges only when the user is denied access to the 
object/application. Accordingly, for at least the reasons set forth above, Applicants 
respectfully submit that Claim 5 is patentable over Kraenzel. 

Claims 7-11 and 13-15 depend directly from independent Claim 5. When the 
recitations of Claims 7-11 and 13-15 are considered in combination with the recitations of 
Claim 5, Applicants submit that dependent Claims 7-11 and 13-15 likewise are patentable 
over Kraenzel. 

For at least the reasons set forth above, Applicants respectfully request that the 
Section 102 rejection of Claims 1, 3-11, and 13-15 be withdrawn. 

The rejection of Claim 2 under 35 U.S.C. § 103 as being unpatentable over Kraenzel 
in view of Behera (U.S. Pat. No. 6,535,879), CERN [Administrative Information Services, 
Oracle HR] and Lillibridge (U.S. Pat. No. 6,195,698) is respectfully traversed. 

Kraenzel is described above. 

Behera describes an access control via properties system that provides Access Control 
List (ACL) rules that are structured such that the ACL rules indicate the attributes that the 
administrator has selected for user access and specifies the type of access to be granted to a 
user which can include: read, write, or any other privileges that the system supports. The 
desired attributes that the user must have to be granted such access is also listed along with 
the attribute fieldname associated with the desired attributes. The directory server will match 
the desired attributes within the specified attribute fieldname with the user's attributes and 
allows access to the directory entry only if the user has the desired attribute values. 
Alternatively, a match function can be specified for the desired attributes where the directory 
server matches the desired attributes with the user and the owner of the list of attributes and 
allows access to the directory entry only if the both the user and the owner have the desired 
attribute values. When a user accesses a directory entry, the directory server selects and 
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analyzes a specific access control command according to the attribute being accessed. 
Notably, Behera does not describe or suggest determining denied access or granted access 
with reference to user access to a set of specific data within the directory entry. 

CERN is a hardcopy of a webpage dated 9/29/03 that lists the major functions of 
Oracle*HR as: personal information management, assignments (contracts) management, 
recruitment management, payroll elements management, absence entitlement management, 
career management, management of official documents, access rights, etc., and structures 
management (divisions, experiments), etc. Notably CERN does not describe nor suggest 
determining denied access or granted access with reference to user access to a set of specific 
data within an application. 

Lillibridge describes a computerized access request method wherein a server 
computer receives an access request from a client computer. The server computer generates a 
predetermined number of random characters that are used to form a string in the server 
computer. The string is randomly modified either visually or audibly to form a riddle. The 
original string is the correct answer to the riddle. The server computer renders the riddle on 
an output device of the client computer, and the client computer sends an answer to the 
server. The server determines if the guess is the correct answer, and if so, the access request 
is accepted. Notably Lillibridge does not describe nor suggest determining denied access or 
granted access with reference to user access to a set of specific data within an application. 

Applicants respectfully submit that the Section 103 rejection of the presently pending 
claims is not a proper rejection. As is well established, obviousness cannot be established by 
combining the teachings of the cited art to produce the claimed invention, absent some 
teaching, suggestion, or incentive supporting the combination. None of Kraenzel, Behera, 
CERN, nor Lillibridge, considered alone or in combination, describe or suggest the claimed 
combination. Furthermore, in contrast to the assertion within the Office Action, Applicants 
respectfully submit that it would not be obvious to one skilled in the art to combine Kraenzel, 
Behera, CERN, and Lillibridge, because there is no motivation to combine the references 
suggested in the art. Additionally, the Examiner has not pointed to any prior art that teaches 
or suggests to combine the disclosures, other than Applicants' own teaching. 

As the Federal Circuit has recognized, obviousness is not established merely by 
combining references having different individual elements of pending claims. Ex parte 
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Levengood 28 U.S.P.Q.2d 1300 (Bd. Pat. App. & Inter. 1993). MPEP 2143.01. Rather, 
there must be some suggestion, outside of Applicants 5 disclosure, in the prior art to combine 
such references, and a reasonable expectation of success must be both found in the prior art, 
and not based on Applicant's disclosure. In re Vaeck , 20 U.S.P.Q.2d 1436 (Fed. Cir. 1991). 
In the present case, neither a suggestion or motivation to combine the prior art disclosures, 
nor any reasonable expectation of success has been shown. 

Furthermore, it is impermissible to use the claimed invention as an instruction manual 
or "template" to piece together the teachings of the cited art so that the claimed invention is 
rendered obvious. Specifically, one cannot use hindsight reconstruction to pick and choose 
among isolated disclosures in the art to deprecate the claimed invention. Further, it is 
impermissible to pick and choose from any one reference only so much of it as will support a 
given position, to the exclusion of other parts necessary to the full appreciation of what such 
reference fairly suggests to one of ordinary skill in the art. The present Section 103 rejection 
is based on a combination of teachings selected in an attempt to arrive at the claimed 
invention. Since there is no teaching nor suggestion in the cited art for the combination, the 
Section 103 rejection appears to be based on a hindsight reconstruction in which isolated 
disclosures have been picked and chosen in an attempt to deprecate the present invention. Of 
course, such a combination is impermissible, and for this reason alone, Applicants request 
that the Section 103 rejection be withdrawn. 

Moreover, and to the extent understood, neither Kraenzel, Behera, CERN, nor 
Lillibridge, considered alone or in combination, describe or suggest the claimed invention. 
Specifically, Claim 1 recites a method for providing access to users based on user profiles 
and using a web-based system that includes a server system coupled to a centralized 
interactive database and at least one client system, the method including "determining 
whether to grant the user access to an application after completing an evaluation based on the 
electronic profiles, pre-determined rules, and operating methodology in response to a request 
from the user for access to the application; if the user is denied access to the application, 
notifying the user of the denial to access the application; if the user is granted access to the 
application, determining whether to grant the user access to a set of specific data within the 
application after completing an evaluation based on the electronic profiles, pre-determined 
rules, and operating methodology in response to a request from the user for access to the set 
of specific data; if the user is denied access to the set of specific data . . . prompting the user 
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to complete a request for quick approval wherein the request for quick approval includes a 
list of data for approval . . . automatically determining, using an internal exception access 
process an approval or a disapproval of quick access based on pre-established criteria and the 
list of data for approval; if the request for quick approval is approved, at least one of 
automatically adding a rule to the centralized database and automatically adding the user to 
the centralized database for access to the set of specific data ... if the rule is added, updating 
an exception list ... if the user is added, updating the centralized database to permit the user 
access to the set of specific data . . . notifying the user of the approval of the request for quick 
approval; if the request for quick approval is denied, notifying the user of the denial of the 
request for quick approval; and if the user is granted access to the set of specific data, making 
the set of specific data available to the user." 

None of Kraenzel, Behera, CERN, nor Lillibridge, considered alone or in 
combination, describe or suggest a method for providing access to users based on user 
profiles and using a web-based system that includes a server system coupled to a centralized 
interactive database and at least one client system as recited in Claim 1. More specifically, 
no combination of Kraenzel, Behera, CERN, and Lillibridge describes or suggests a method 
including, if the user is granted access to an application, determining whether to grant the 
user access to a set of specific data within the application. Rather, in contrast to the present 
invention, Kraenzel describes determining whether the user has requested additional 
privileges only when the user is denied access to the object/application, Behera describes an 
access control via properties system that allows access to the directory entry only if the user 
has the desired attribute values, CERN describes an Oracle Human Resources application 
used at CERN, and Lillibridge describes generating a riddle and waiting for a predetermined 
amount of time for a correct response from a client system. Accordingly, for at least the 
reasons set forth above, Applicants respectfully submit that Claim 1 is patentable over 
Kraenzel in view of Behera, CERN, and Lillibridge. 

Claim 2 depends directly from independent Claim 1 . When the recitations of Claim 2 
are considered in combination with the recitations of Claim 1, Applicants submit that 
dependent Claim 2 is also patentable over Kraenzel in view of Behera, CERN,. and 
Lillibridge. 
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For at least the reasons set forth above, Applicants respectfully request that the 
Section 103 rejection of Claim 2 be withdrawn. 

The rejection of Claim 12 under 35 U.S.C. § 103 as being unpatentable over Kraenzel 
is respectfully traversed. 

Kraenzel is described above. 

Claim 5 recites a method for managing user profile information, including managing 
access control to applications and data by implementing a level of security across the 
different applications that is the same for each application, using a web-based system that 
includes a server system coupled to a centralized interactive database and at least one client 
system, the method including "providing capabilities for a user to request access to 
information that the user currently does not have access to; tracking a status of a request 
using a tracking component coupled to the centralized interactive database; obtaining a 
decision of whether to grant the user access to a user requested application from an owner of 
the application requested; implementing the decision comprising ... if the user is denied 
access to the application, notifying the user of the denial to access the application; if the user 
is granted access to the application, determining whether to grant the user access to a set of 
specific data within the application after completing an evaluation based on the electronic 
profiles, pre-determined rules, and operating methodology in response to a request from the 
user for access to the set of specific data; if the user is denied access to the set of specific data 
. . . prompting the user to complete a request for quick approval wherein the request for quick 
approval includes a list of the information the user is requesting access to for approval . . . 
automatically determining, using an internal exception access process an approval or a 
disapproval of quick access based on pre-established criteria and the list of information the 
user is requesting access to; if the request for quick approval is approved, at least one of 
automatically adding a rule to the centralized interactive database and automatically adding 
the user to the centralized interactive database for access to the set of specific data ... if the 
rule is added, updating an exception list ... if the user is added, updating the centralized 
interactive database to permit the user access to the set of specific data . . . notifying the user 
of the approval of the request for quick approval; if the request for quick approval is denied, 
notifying the user of the denial of the request for quick approval; and if the user is granted 
access to the set of specific data, making the set of specific data available to the user." 
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Kraenzel does not describe or suggest a method for managing user profile 
information, including managing access control to applications and data by implementing a 
level of security across the different applications that is the same for each application, using a 
web-based system that includes a server system coupled to a centralized interactive database 
and at least one client system as recited in Claim 5. More specifically, Kraenzel does not 
describe or suggest a method including, if the user is granted access to an application, 
determining whether to grant the user access to a set of specific data within the application. 
Rather, in contrast to the present invention, Kraenzel describes determining whether the user 
has requested additional privileges only when the user is denied access to the 
object/application. Accordingly, for at least the reasons set forth above, Applicants 
respectfully submit that Claim 5 is patentable over Kraenzel. 

Claim 12 depends directly from independent Claim 5. . When the recitations of Claim 
12 are considered in combination with the recitations of Claim 5, Applicants submit that 
dependent Claim 12 likewise is patentable over Kraenzel. 

For at least the reasons set forth above, Applicants respectfully request that the 
Section 103 rejection of Claim 12 be withdrawn. 

In view of the foregoing amendments and remarks, all the claims now active in this 
application are believed to be in condition for allowance. Reconsideration and favorable 
action is respectfully solicited. 
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